◇ OpenCyber Academy
Bachelor's · Chapter 11 · English

Chapter 11 — Governance foundations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Governance foundations

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 A definition"]
  N2["11.2 Governance and management"]
  N3["11.3 Frameworks"]
  N4["11.4 Harbourline's starting point"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 A definition"]
  N2["11.2 Governance and management"]
  N3["11.3 Frameworks"]
  N4["11.4 Harbourline's starting point"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
    |
    v
[11.1 A definition]
    |
    v
[11.2 Governance and management]
    |
    v
[11.3 Frameworks]
    |
    v
[11.4 Harbourline's starting point]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) define data governance; (2) compare governance with data management; (3) describe frameworks used in practice.

11.1 A definition

In year two Amara studies governance directly. DAMA-DMBOK2 describes data governance as the exercise of authority, control and shared decision-making over the management of data assets. Dr. Lindqvist simplifies this for Harbourline: deciding who decides what about data, and making sure those decisions are followed. Amara notes that the definition centres on decisions and accountability rather than technology, which explains why earlier chapters found that problems persisted even after Harbourline bought new systems. Amara writes the simpler definition at the front of her notes.

11.2 Governance and management

Amara learns to separate governance from management. Management does the work: running databases, cleaning records, building reports. Governance sets direction and checks that the work meets agreed standards. At Harbourline, the data team manages the loyalty database, while a governance group should decide definitions, quality targets and permitted uses. Mixing the two leaves the people doing the work also deciding the rules, with nobody independent checking whether those rules serve the whole co-operative fairly. Amara draws the separation as two columns in her notes.

11.3 Frameworks

Amara compares frameworks. DAMA-DMBOK2 organises data management into knowledge areas, with governance at the centre. ISO/IEC 38505-1 applies the governance of IT standard to data, asking governing bodies to evaluate, direct and monitor data use. Khatri and Brown describe five decision domains: principles, quality, metadata, access and life cycle. She explains that frameworks provide vocabulary and checklists, but each organisation must adapt them to its size and needs rather than copying them in full. Amara chooses Khatri and Brown's domains for her assessment.

11.4 Harbourline's starting point

Amara assesses Harbourline against Khatri and Brown's domains. Principles are unwritten. Quality is handled reactively when complaints arrive. Metadata exists only in a few spreadsheets. Access is granted by IT on request without owner approval. Life cycle decisions such as retention are left to individual teams. She summarises the position in a one-page table that the co-operative's operations director later uses to argue for setting up a governance group with a clear mandate. Amara's table becomes the first document the new group reviews.

Worked example

Amara defines governance as deciding who decides about data, separates it from management, compares DAMA-DMBOK2, ISO/IEC 38505-1 and Khatri and Brown and assesses Harbourline against five domains.

Synthetic case. Harbourline is synthetic; the frameworks are real.

Errors and limits

Copying a full framework into a small organisation creates unused bureaucracy.

Exercises

Continue studying — lesson 11 (chapter 11 of 40)

← Chapter 10 · Course chapter index · Chapter 12 →

Continue to the next authored lesson.